Forums - Enabling secure boot

10 posts / 0 new
Last post
Enabling secure boot
sv.jinka
Join Date: 26 Sep 18
Posts: 10
Posted: Wed, 2018-11-14 08:04

Hi Team,

 

Followed the document suggested https://developer.qualcomm.com/download/enable-secure-boot-qca402x.pdf  to enable secure boot mode. 

  

I enabled the Secure boot using "Enable secure boot via OTP programmer" section in the doc.

"OTP update success" message got displayed resembling the successful enabling of secure boot feature.

 

Building a signed image:

    By making the suggested modifications in "build.bat" file we build the Application successfully.

 

Flashing signed image:

    I followed "Flash the image using USB"  instructions,

    Modified the "qflash.py" to overcome errors. Mentioned the code changes below at the end. 

 

    I was unable to flash facing the below error,

            qflash_app.py Info: Check for QDLoader port in Device Manager.

            qflash_app.py Info: Need to reset device?

            qflash_app.py Error: QSaharaServer failed to load Device Programmer.

 

Below is the code change I made in qflash.py,

 

def path_to_app(app_spec):
    global secboot_dir
 
    app_spec = os.path.abspath(app_spec)
    print app_spec
    app_spec = app_spec + "//4020/"
    print app_spec
    if os.path.isdir(app_spec):
        secure_dir = ''.join((glob.glob(os.path.join(app_spec, "m4"))));
    print secure_dir
        if (os.path.isdir(secure_dir)):
            img_name = ''.join((glob.glob(os.path.join(secure_dir, "*.elf"))));
            if img_name and os.path.isfile(img_name):
                print secboot_dir
                secboot_dir = app_spec
                return img_name # Case4
 
    # Error case -- cannot decide what M4 app to program
    FAIL("Cannot determine application for " + str(app_spec) + "\nPlease check --app.")
 

Below are the debug logs while flashing the image,

 
C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\target\quartz\demo\QCLI_demo\build\g
cc\output>py -2 C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\target\build\tools\f
lash\qflash_app.py --comm=22 --debug
qflash_app.py Info: want_gen is True
qflash_app.py Info: want_dev is True
qflash_app.py Info: erase is False
qflash_app.py Info: Executing in C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\tar
get\quartz\demo\QCLI_demo\build\gcc
qflash_app.py Info: comm_port is 22
qflash_app.py Info: script is qflash_app.py
qflash_app.py Info: flash tool path is build\tools\flash
qflash_app.py Info: Initial cwd is C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\t
arget\quartz\demo\QCLI_demo\build\gcc
qflash_app.py Info: Check for SDK top-level: C:\Users\ashis\Desktop\QCA4020.OR.2
.0_00048\target\quartz\demo\QCLI_demo\build\gcc
qflash_app.py Info: Check for SDK top-level: C:\Users\ashis\Desktop\QCA4020.OR.2
.0_00048\target\quartz\demo\QCLI_demo\build
qflash_app.py Info: Check for SDK top-level: C:\Users\ashis\Desktop\QCA4020.OR.2
.0_00048\target\quartz\demo\QCLI_demo
qflash_app.py Info: Check for SDK top-level: C:\Users\ashis\Desktop\QCA4020.OR.2
.0_00048\target\quartz\demo
qflash_app.py Info: Check for SDK top-level: C:\Users\ashis\Desktop\QCA4020.OR.2
.0_00048\target\quartz
qflash_app.py Info: Check for SDK top-level: C:\Users\ashis\Desktop\QCA4020.OR.2
.0_00048\target
qflash_app.py Info: SDK is C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\target
qflash_app.py Info: Flash tools are at C:\Users\ashis\Desktop\QCA4020.OR.2.0_000
48\target\build\tools\flash
C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\target\quartz\demo\QCLI_demo\build\g
cc
C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\target\quartz\demo\QCLI_demo\build\g
cc//4020/
C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\target\quartz\demo\QCLI_demo\build\g
cc//4020/m4
None
qflash_app.py Info: Use M4 image(s): ['C:\\Users\\ashis\\Desktop\\QCA4020.OR.2.0
_00048\\target\\quartz\\demo\\QCLI_demo\\build\\gcc//4020/m4\\Quartz.elf']
qflash_app.py Info: Generate partition table...
qflash_app.py Info: M4_img_name is C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\t
arget\quartz\demo\QCLI_demo\build\gcc//4020/m4\Quartz.elf
qflash_app.py Info: M4_name is Quartz.elf
qflash_app.py Info: wlan_dir is C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\targ
et\quartz\demo\QCLI_demo\build\gcc//4020/kf
qflash_app.py Info: FS2IMG IS NONE
qflash_app.py Info: Execute: python "C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048
\target\build\tools\flash\gen_part_table.py" --output="output\generated_partitio
n_table.xml" --begin=76KB --partition --file="C:\Users\ashis\Desktop\QCA4020.OR.
2.0_00048\target\quartz\demo\QCLI_demo\build\gcc//4020/m4\Quartz.elf" --partitio
n --file="C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\target\quartz\demo\QCLI_de
mo\build\gcc//4020/m0\ioe_ram_m0_threadx_ipt.mbn" --partition --file="C:\Users\a
shis\Desktop\QCA4020.OR.2.0_00048\target\quartz\demo\QCLI_demo\build\gcc//4020/k
f\wlan_fw_img.bin" --partition --id=FS1 --start=12KB --size=64KB --partition --i
d=UNUSED --size=8KB --start=4KB
qflash_app.py Info: Generate FWD table...
qflash_app.py Info: Execute: python "C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048
\target\build\tools\flash\gen_fwd_table.py" -x "output\generated_partition_table
.xml" --rawprogram "output\generated_fwd_table.xml" --fdtbin "output\firmware_ta
ble.bin"
[2018-11-14 20:57:07,691] INFO: Checking for files to add to the image for Firmw
are Descriptor Table 0 File:gen_fwd_table.py:673 Function:gen_xml_program
[2018-11-14 20:57:07,694] INFO: Done Generating XML file to program. File:gen_fw
d_table.py:711 Function:gen_xml_program
qflash_app.py Info: Using COMM_PORT 22
qflash_app.py Info: Download device programmer...
qflash_app.py Info: windows_dev_prog_name is C:\Users\ashis\Desktop\QCA4020.OR.2
.0_00048\target\build\tools\flash\prog_spinor_firehose_qca4020_lite_m4_threadx.m
bn
qflash_app.py Info: Execute: "C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\target
\build\tools\flash\QSaharaServer.exe" -p \\.\COM22 -s 13:"C:\Users\ashis\Desktop
\QCA4020.OR.2.0_00048\target\build\tools\flash\prog_spinor_firehose_qca4020_lite
_m4_threadx.mbn"
qflash_app.py Info: Check for QDLoader port in Device Manager.
qflash_app.py Info: Need to reset device?
qflash_app.py Error: QSaharaServer failed to load Device Programmer.
 
C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\target\quartz\demo\QCLI_demo\build\g
cc\output>
  • Up0
  • Down0
jaydenk
Join Date: 21 Jun 18
Posts: 64
Posted: Wed, 2018-11-14 10:01

Hi Jinka,

If we want to flash the signed image via USB, we also need to sign device programmer image.

Instead, we can try to flash the signed image via openocd like what secure boot document explained.

Can you try to flash the signed image through openocd?

If you still want to flash image through USB, you can refer previous discussion for the same issue.
There is solution to sign device programmer image.
Please refer following discussion:

https://developer.qualcomm.com/forum/qdn-forums/hardware/qca4020-qca4024...

Thanks
BR,
Jayden

  • Up0
  • Down0
sv.jinka
Join Date: 26 Sep 18
Posts: 10
Posted: Fri, 2018-11-16 04:30

Hi jaydenk, 
Thanks for your response.

As you suggested I started using JTAG for flashing the image following the guidelines. Below are the jumper settings I made on board 

J57  pins 2 and 3 for J6 Power
LED_PWR J20  pins 1 and 2 to power up LED
EDL mode,  pins 1 and 2
J30  pins 1 and 2 for JTAG
J32  pins 1 and 2 for JTAG
J37  pins 2 and 3 for JTAG
J38-J39
Connect J38 pins 2 and J39 pins 3 for JTAG
Connect J38 pins 3 and J39 pins 2 for JTAG
J40 Connect J40 pins 2 and 3 for JTAG
J31 flashing, pins 1 and 2

I connected the boat the micro USB cables and executed the flash_openocd.bat. I saw  Flash Operation Completed Successfully...  message, but my application is not getting booted up. Find below the flash logs 
 
 
 
C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\target\quartz\demo\QCLI_demo\build\g
cc>flash_openocd.bat
Open On-Chip Debugger 0.9.0 (2015-08-15-12:41)
Licensed under GNU GPL v2
For bug reports, read
adapter speed: 5000 kHz
Error: libusb_claim_interface() failed with LIBUSB_ERROR_NOT_SUPPORTED
Error: unable to open ftdi device with vid 0403, pid 6010, description '*' and s
erial '*'
 
[2018-11-16 17:37:42,861] INFO: Checking for files to add to the image for Firmw
are Descriptor Table 0 File:gen_fwd_table.py:673 Function:gen_xml_program
[2018-11-16 17:37:42,865] INFO: Done Generating XML file to program. File:gen_fw
d_table.py:711 Function:gen_xml_program
Starting GDB Server....
[2018-11-16 17:37:42,920] INFO: flash_through_gdb.py version 1.0.5 File:flash_th
rough_gdb.py:596 Function:main
[2018-11-16 17:37:43,009] DEBUG: Output Directory is gdbout/ File:flash_through_
gdb.py:628 Function:main
[2018-11-16 17:37:43,009] DEBUG: Search Path 1 ..\..\..\..\..\quartz\demo\QCLI_d
emo\build\gcc\4020\m4/ File:flash_through_gdb.py:640 Function:main
[2018-11-16 17:37:43,009] DEBUG: Search Path 2 ..\..\..\..\..\quartz\demo\QCLI_d
emo\build\gcc\4020\m0/ File:flash_through_gdb.py:640 Function:main
[2018-11-16 17:37:43,010] DEBUG: Search Path 3 ..\..\..\..\..\quartz\demo\QCLI_d
emo\build\gcc\4020\kf/ File:flash_through_gdb.py:640 Function:main
[2018-11-16 17:37:43,010] DEBUG: Search Path 4 ./ File:flash_through_gdb.py:640
Function:main
[2018-11-16 17:37:43,015] INFO: Will write file ./firmware_table.bin into sector
s [0, 0] File:flash_through_gdb.py:675 Function:main
[2018-11-16 17:37:43,016] DEBUG: C:/Program Files (x86)/GNU Tools Arm Embedded/7
 2018-q2-update/bin/arm-none-eabi-gdb.exe --command="gdbout/gdb_commands.txt" --
batch File:flash_through_gdb.py:451 Function:run
GNU gdb (GNU Tools for Arm Embedded Processors 7-2018-q2-update) 8.1.0.20180315-
git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=i686-w64-mingw32 --target=arm-none-eabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
Find the GDB manual and other documentation resources online at:
For help, type "help".
Type "apropos word" to search for commands related to "word".
[2018-11-16 17:37:43,109] INFO: GDB can run without shell=true File:flash_throug
h_gdb.py:435 Function:_check_need_shell
gdbout/gdb_commands.txt:1: Error in sourced command file:
localhost:3333: No connection could be made because the target machine actively
refused it.
[2018-11-16 17:37:44,219] ERROR: Unable to open the file 'gdbout/command_result.
log'
 File:flash_through_gdb.py:256 Function:_check_status
Traceback (most recent call last):
  File "..\..\..\..\..\build\tools\flash/flash_through_gdb.py", line 249, in _ch
eck_status
    f = open(self.cmd_status_file , 'rb')
IOError: [Errno 2] No such file or directory: 'gdbout/command_result.log'
[2018-11-16 17:37:44,223] WARNING: The last command return error
 File:flash_through_gdb.py:259 Function:_check_status
[2018-11-16 17:37:44,223] ERROR: Failed to write to start sector=0, num sectors=
1 File:flash_through_gdb.py:678 Function:main
Flash Operation Completed Successfully...

 

  • Up0
  • Down0
c_rpedad
Profile picture
Join Date: 18 Jun 18
Location: San Jose
Posts: 317
Posted: Fri, 2018-11-16 11:28

From the above logs, the flashing through JTAG has been failed with below errors.

Error: libusb_claim_interface() failed with LIBUSB_ERROR_NOT_SUPPORTED
Error: unable to open ftdi device with vid 0403, pid 6010, description '*' and serial '*'

Kindly follow the instructions from Section "3.7.2.1 Install FTDI driver for JTAG" of document "QCA402x (CDB2x) Development Kit User Guide" and try JTAG flashing again.

  • Up0
  • Down0
sv.jinka
Join Date: 26 Sep 18
Posts: 10
Posted: Wed, 2018-11-21 04:17

I installed the drivers according to the instructions given in guidelines.

Now when I try to flash the image, I face the below error logs.

C:\Users\ashis\Desktop\QCA4020.OR.2.0_00048\target\quartz\demo\QCLI_demo\build\g

cc>flash_openocd.bat

Open On-Chip Debugger 0.9.0 (2015-08-15-12:41)

Licensed under GNU GPL v2

For bug reports, read

        http://openocd.org/doc/doxygen/bugs.html

[2018-11-16 17:37:42,861] INFO: Checking for files to add to the image for Firmw

are Descriptor Table 0 File:gen_fwd_table.py:673 Function:gen_xml_program

[2018-11-16 17:37:42,865] INFO: Done Generating XML file to program. File:gen_fw

d_table.py:711 Function:gen_xml_program

Starting GDB Server....

[2018-11-16 17:37:42,920] INFO: flash_through_gdb.py version 1.0.5 File:flash_th

rough_gdb.py:596 Function:main

[2018-11-16 17:37:43,009] DEBUG: Output Directory is gdbout/ File:flash_through_

gdb.py:628 Function:main

[2018-11-16 17:37:43,009] DEBUG: Search Path 1 ..\..\..\..\..\quartz\demo\QCLI_d

emo\build\gcc\4020\m4/ File:flash_through_gdb.py:640 Function:main

[2018-11-16 17:37:43,009] DEBUG: Search Path 2 ..\..\..\..\..\quartz\demo\QCLI_d

emo\build\gcc\4020\m0/ File:flash_through_gdb.py:640 Function:main

[2018-11-16 17:37:43,010] DEBUG: Search Path 3 ..\..\..\..\..\quartz\demo\QCLI_d

emo\build\gcc\4020\kf/ File:flash_through_gdb.py:640 Function:main

[2018-11-16 17:37:43,010] DEBUG: Search Path 4 ./ File:flash_through_gdb.py:640

Function:main

[2018-11-16 17:37:43,015] INFO: Will write file ./firmware_table.bin into sector

s [0, 0] File:flash_through_gdb.py:675 Function:main

[2018-11-16 17:37:43,016] DEBUG: C:/Program Files (x86)/GNU Tools Arm Embedded/7

 2018-q2-update/bin/arm-none-eabi-gdb.exe --command="gdbout/gdb_commands.txt" --

batch File:flash_through_gdb.py:451 Function:run

GNU gdb (GNU Tools for Arm Embedded Processors 7-2018-q2-update) 8.1.0.20180315-

git

Copyright (C) 2018 Free Software Foundation, Inc.

License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software: you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.  Type "show copying"

and "show warranty" for details.

This GDB was configured as "--host=i686-w64-mingw32 --target=arm-none-eabi".

Type "show configuration" for configuration details.

For bug reporting instructions, please see:

<http://www.gnu.org/software/gdb/bugs/>.

Find the GDB manual and other documentation resources online at:

<http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".

Type "apropos word" to search for commands related to "word".

[2018-11-16 17:37:43,109] INFO: GDB can run without shell=true File:flash_throug

h_gdb.py:435 Function:_check_need_shell

gdbout/gdb_commands.txt:1: Error in sourced command file:

localhost:3333: No connection could be made because the target machine actively

refused it.

[2018-11-16 17:37:44,219] ERROR: Unable to open the file 'gdbout/command_result.

log'

 File:flash_through_gdb.py:256 Function:_check_status

Traceback (most recent call last):

  File "..\..\..\..\..\build\tools\flash/flash_through_gdb.py", line 249, in _ch

eck_status

    f = open(self.cmd_status_file , 'rb')

IOError: [Errno 2] No such file or directory: 'gdbout/command_result.log'

[2018-11-16 17:37:44,223] WARNING: The last command return error

 File:flash_through_gdb.py:259 Function:_check_status

[2018-11-16 17:37:44,223] ERROR: Failed to write to start sector=0, num sectors=

1 File:flash_through_gdb.py:678 Function:main

Flash Operation Completed Successfully...


Below is the Jumper settings I made,

   J57  pins 2 and 3 for J6 Power

    LED_PWR J20  pins 1 and 2 to power up LED
    EDL mode,  pins 1 and 2
    J30  pins 1 and 2 for JTAG
    J32  pins 1 and 2 for JTAG
    J37  pins 2 and 3 for JTAG
    J40 pins 2 and 3 for JTAG
    J31 for flashing pins 1 and 2, removing for boot
    J38-J39
        Connect J38 pins 2 and J39 pins 3 for JTAG
        Connect J38 pins 3 and J39 pins 2 for JTAG

I also tried to flash with USB according to the instructions in the forum thread, 
https://developer.qualcomm.com/forum/qdn-forums/hardware/qca4020-qca4024/61642


But we are unable to flash the image.

As mentioned in the reply, that the code change not to be made in "qflash.py". If we didn't change the code accordingly the "qfalsh.py" is unable to detect Quartz.elf file


 


 


 

*/



 

  • Up0
  • Down0
c_rpedad
Profile picture
Join Date: 18 Jun 18
Location: San Jose
Posts: 317
Posted: Wed, 2018-11-21 14:10

Kindly try with openocd version 0.10.0 

The supported version is OpenOCD-20170609 available at  http://gnutoolchains.com/arm-eabi/openocd/

After extracting the folder, add the path to OpenOCD.
Example:
If there is openocd.exe in C:\ Program Files\OpenOCD-20170609\bin,
set the path as follows:
set %PATH%=%PATH%:C:\ Program Files\OpenOCD-20170609\bin

  • Up0
  • Down0
sv.jinka
Join Date: 26 Sep 18
Posts: 10
Posted: Wed, 2018-11-21 22:48

I tried the suggestions you mentioned, but the result is same

  • Up0
  • Down0
sv.jinka
Join Date: 26 Sep 18
Posts: 10
Posted: Thu, 2018-11-22 05:51

I flashed it successfully using USB. I hope the user document need to be updated regarding generation image of prog_spinor_firehose_qca4020_lite_m4_threadx.mbn  and replacing the old one.

  • Up0
  • Down0
sv.jinka
Join Date: 26 Sep 18
Posts: 10
Posted: Thu, 2018-11-22 20:26
Below are the modification need to be made in "80-ya121-144_a_enable_secure_boot_on_qca402xcdb2x_1.pdf" document.
 
4.A.2 Building signed image :
 
1. Signing FIREHOSE image (prog_spinor_firehose_qca4020_lite_m4_threadx.mbn):
 
Add this below line in build.bat along with the modifications suggested
 
    python %SectoolsQdnDir%\sectools.py iot -p 4020 -g m4 -i %RootDir%\build\tools\flash\prog_spinor_firehose_qca4020_lite_m4_threadx.mbn -k %SectoolsCertsDir%\qpsa_rootca.key -c %SectoolsCertsDir%\qpsa_rootca.cer --cfg_oem_id=0xffff --cfg_model_id=0x0000 -o . -s
 
post modification it looks like,
 
if /I "%SECBOOT%" == "true" (
IF /I "%BOARD_VARIANT%" == "CDB" (
    python %SectoolsQdnDir%\sectools.py iot -p 4020 -g m4 -i %OUTDIR%\%PROJECT%.elf -k %SectoolsCertsDir%\qpsa_rootca.key -c %SectoolsCertsDir%\qpsa_rootca.cer --cfg_oem_id=0xffff --cfg_model_id=0x0000 -o . -s
    python %SectoolsQdnDir%\sectools.py iot -p 4020 -g m0 -i %RootDir%\bin\cortex-m0\threadx\ioe_ram_m0_threadx_ipt.mbn -k %SectoolsCertsDir%\qpsa_rootca.key -c %SectoolsCertsDir%\qpsa_rootca.cer --cfg_oem_id=0xffff --cfg_model_id=0x0000 -o . -s
    python %SectoolsQdnDir%\sectools.py iot -p 4020 -g kf -i %RootDir%\bin\wlan\wlan_fw_img.bin -k %SectoolsCertsDir%\qpsa_rootca.key -c %SectoolsCertsDir%\qpsa_rootca.cer --cfg_oem_id=0xffff --cfg_model_id=0x0000 -o . -s
    python %SectoolsQdnDir%\sectools.py iot -p 4020 -g m4 -i %RootDir%\build\tools\flash\prog_spinor_firehose_qca4020_lite_m4_threadx.mbn -k %SectoolsCertsDir%\qpsa_rootca.key -c %SectoolsCertsDir%\qpsa_rootca.cer --cfg_oem_id=0xffff --cfg_model_id=0x0000 -o . -s
)
 
2. Build the Application executing #build.bat t 4020 cdb
3. Repalce the “prog_spinor_firehose_qca4020_lite_m4_threadx.mbn” in target/build/tools/flash/prog_spinor_firehose_qca4020_lite_m4_threadx.mbn  with the one in QCLI_demo/build/gcc/4020/m4/prog_spinor_firehose_qca4020_lite_m4_threadx.mbn
 
4.A.3 Flashing signed image
 
1. Generate the partition table and Flash the image using below respective commands,
 
#python ..\..\..\..\..\build\tools\flash\gen_part_table.py --output=output\generated_partition_table.xml --begin=76KB --partition --file=.\4020\m4\Quartz.elf --partition --file=.\4020\m0\ioe_ram_m0_threadx_ipt.mbn --partition --file=.\4020\kf\wlan_fw_img.bin --partition --id=FS1 --start=12KB -- size=64KB --partition --id=UNUSED --size=8KB --start=4KB
 
#python ..\..\..\..\..\build\tools\flash\qflash.py --comm xx -–nogen
 
  • Up0
  • Down0
jaydenk
Join Date: 21 Jun 18
Posts: 64
Posted: Tue, 2018-11-27 16:34

Hi sv.jinka,

I expect you could flash images successfully.

If you have any other problem, please let me know that in detail.

Thanks
BR,
Jayden

  • Up0
  • Down0
or Register

Opinions expressed in the content posted here are the personal opinions of the original authors, and do not necessarily reflect those of Qualcomm Incorporated or its subsidiaries (“Qualcomm”). The content is provided for informational purposes only and is not meant to be an endorsement or representation by Qualcomm or any other party. This site may also provide links or references to non-Qualcomm sites and resources. Qualcomm makes no representations, warranties, or other commitments whatsoever about any non-Qualcomm sites or third-party resources that may be referenced, accessible from, or linked to this site.